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CLAIMS 

1. A method for tracing source addresses of packets, the 
method comprising: 

identifying at least part of a source address of a packet; 

and 

determining whether the at least part of the source address 
matches at least one source address recorded within a 
predetermined time period prior to arrival of the packet. 

2. The method according to claim 1, where the at least one 
source address is recorded in a hierarchical data structure. 

3. The method according to claim 1, where a Last Time Seen 
(LTS) value associated with each of the at least one source 
address is recorded. 

4. The method according to claim 1 further comprising: 
routing the packet if the at least part of the source 

address matches at least one source address recorded within the' 
predetermined time period prior to the arrival of the packet; 
and 

recording an arrival time of the packet. 



57983.000166 WASHINGTON 384010v5 



21 



Patent Application 
Attorney Docket No.: 57983.000166 
Client Reference No.: 16399ROUS01U 

5. The method according to claim 1 further comprising: 
routing the packet with a warning if the at least part of 

the source address does not match at least one source address 
recorded within the predetermined time period prior to the 
5 arrival of the packet; and 

recording the at least part of the source address and an 
arrival time of the packet. 

6. The method according to claim 5, where the warning is 
10 recorded in a read-only medium. 

7. The method according to claim 1 further comprising issuing 
a warning and discarding the packet if the at least part of the 
source address does not match at least one source address 

15 recorded within the predetermined time period prior to the 
arrival of the packet. 

8. The method according to claim 7, where the warning is 
recorded in a read-only medium. 

20 

9. The method according to claim 1, where the source address 
of the packet is an internet protocol (IP) address. 
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10. At least one signal embodied in at least one carrier wave 
for transmitting a computer program of instructions configured 
to be readable by at least one processor for instructing the at 
least one processor to execute a computer process for performing 
the method as recited in claim 1. 

11. At least one processor readable carrier for storing a 
computer program of instructions configured to be readable by at 
least one processor for instructing the at least one processor 
to execute a computer process for performing the method as 
recited in claim 1. 

12. A system for tracing source addresses of packets comprising 
at least one network element, where the at least one network 
element comprises : 

a processor module that identifies at least part of a 
source address of a packet and determines whether the at least 
part of the source address matches at least one source address 
recorded within a predetermined time period prior to arrival of 
the packet; and 

a storage module that stores the at least one source 
address recorded within a predetermined time period prior to 
arrival of the packet. 
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13. The system according to claim 12, where the at least one 
source address is recorded in a hierarchical data structure. 

5 14. The system according to claim 12, where a Last Time Seen 
(LTS) value associated with each of the at least one source 
address is recorded. 

15. The system according to claim 12, where the processor 
module is further adapted to 

route the packet if the at least part of the source address 
matches at least one source address recorded within the 
predetermined time period prior to the arrival of the packet; 
and 

record an arrival time of the packet. 

16. The system according to claim 12, where the processor 
module is further adapted to 

route the packet with a warning if the at least part of the 
20 source address does not match at least one source address 
recorded within the predetermined time period prior to the 
arrival of the packet; and 

record the at least part of the source address and an 
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arrival time of the packet. 

17. The system according to claim 16, where the warning is 
recorded in a read-only medium. 

5 

18. The system according to claim 12, where the processor 
module is further adapted to issue a warning and discard the 
packet if the at least part of the source address does not match 
at least one source address recorded within the predetermined 

10 time period prior to the arrival of the packet. 

19. The system according to claim 18, where the warning is 
recorded in a read-only medium. 

15 20. The system according to claim 12, where the source address 
of the packet is an internet protocol (IP) address. 

21. A system for tracing source addresses of packets, the 
system comprising: 
20 means for identifying at least part of a source address of 

a packet; and 

means for determining whether the at least part of the 
source address matches at least one source address recorded 
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within a predetermined time period prior to arrival of the 

packet . 
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